Cybersecurity News: 3 November 2026

Developer platform WorkOS disclosed a data breach after an attacker used the ARTEX AI framework to access an internal sales application. The intrusion exposed business contact records and summaries of customer communications, though no production services were affected. WorkOS advised customers to remain vigilant for phishing attempts leveraging the exposed information.

Blockchain infrastructure provider Chainstack disclosed that an attacker gained unauthorized access to its production systems through a third-party component, exposing customer account information and password hashes. The intrusion, detected on October 31, is assessed to be part of a large-scale, AI-powered attack campaign linked to a China-linked cluster.

Customers are advised to rotate node credentials and API keys, and to remain alert to potential phishing attempts.

Binance revealed that the $6.3 billion theft attributed to North Korea was the result of a months-long campaign involving fake recruitment interviews and compromised AI tools. Attackers tricked engineers into downloading malicious software, gaining access to internal systems and wallet signing infrastructure. The company stated the breach was not a single isolated incident but a sophisticated multi-stage operation.

Password manager mSecure has advised customers to change their passwords, reset two-factor authentication, and remove passkeys after detecting suspicious activity. The developer, mSeven Software, has not explained what happened or whether anyone's secrets were exposed, leaving customers unsure of the scope of the compromise. The vague advice has drawn criticism from users who are unsure which credentials they need to replace.

An attacker broke into the update system of the cPGuard security tool on November 2 and used it to send a malicious script to customers' Linux servers. The script installed a backdoor and collected password hashes and other sensitive files from servers that ran it, cPGuard maker OPSSHIELD said in an advisory. The attacker has since taken some of that data.

Cybersecurity company Barracuda Networks warned customers to patch two vulnerabilities that can let attackers run commands with root privileges. The first is a critical flaw (CVE-2026-116606) stemming from an Email Security Gateway (ESG) authentication weakness that attackers can exploit to modify an appliance's global configuration, while the second (CVE-2026-111560) lets threat actors with admin permissions inject OS commands that run as root.

However, Barracuda said successful exploitation also requires access to the administrative interfaces of targeted devices and advised customers to use appropriate network access controls and restrict access to trusted internal networks to limit exposure.

Frontline Education is notifying over 1.3 million people that their personal information was compromised in a data breach that occurred on August 14. The incident involved the exploitation of a vulnerability in a third-party software product, leading to the theft of names, Social Security numbers, and health insurance details. The company has provided affected US adults with two years of free credit monitoring.

CrowdStrike announced agreements to acquire AI agent observability firm Fiddler AI and AI security testing company Dreadnode in deals reportedly worth a combined $495 million. Fiddler will become Falcon Observe, providing pre-deployment evaluation and tracing of AI agent decisions, while Dreadnode will add automated security testing for AI systems.

The acquisitions aim to address security gaps as companies increasingly adopt AI agents that can hold valid credentials yet make unpredictable decisions.

A 3AM ransomware affiliate encrypted around 37 machines at a UK school estate in an attack that researchers believe may have used AI-generated commands. The threat actor used an automated agentic loop to issue repeated commands at regular intervals, stealing credentials and deploying Mimikatz. The malicious activity spanned from September 10 to 19, though the initial access method remains unknown.

Russian authorities arrested three suspected members of the VasyGrek cybercrime group, also known as Fluffy Wolf, in a rare public crackdown on a long-running hacking operation. The group has targeted Russian companies with phishing emails since 2016, using malicious attachments to steal credentials and access corporate networks.

Police dismantled the group's infrastructure and seized computers and communications equipment from the suspects' homes.

European law enforcement authorities arrested seven suspects and seized more than 100 servers in a joint action targeting an unnamed company suspected of providing fraudulent trading websites to criminal gangs.

Supported by Europol and Eurojust, this coordinated international action involved authorities from Albania, Cyprus, Finland, Germany, Kosovo, and North Macedonia and followed four years of investigation and earlier interventions in 2022 and 2025.

The investigation began in 2022 after a German couple reported they couldn't withdraw money invested through an online trading platform, leading investigators to link multiple call center operators behind investment scams to potential victims in at least 50 countries.

Alpine Linux says attackers targeted its GitLab server using a maximum-severity flaw, CVE-2026-97229, in the Onigmo regex engine used by GitLab CI/CD. The group created an account and submitted crafted CI configurations on October 20-21, causing eight worker crashes, but no successful code execution or package changes were found. The flaw remained in Alpine's custom image because a needed Ruby patch was missing, leaving supply-chain risk.

Google released Android security updates that fix more than 200 vulnerabilities, including two dozen critical issues. The November 1 patch level addresses 119 flaws in Android runtime, Framework and System, including a critical Framework remote code execution bug, CVE-2026-58868, that needs no user interaction. A second November 5 patch fixes 97 bugs in kernel and other components, including critical flaws in Bluetooth, pKVM, HID and modem code.

Google is offering $250,000 for Root-in-Cloud bugs, a top-tier reward for high-impact flaws that give attackers full administrative control over arbitrary Google Cloud organizations. It covers tenant-isolation bypasses and cross-service logic flaws, and reports showing remote code execution in Google production infrastructure will be evaluated for eligibility. Researchers must use a designated service account to prove access and stop probing.

Red Hat released fixed kernels for a critical use-after-free flaw in the Linux kernel's IPv4 TCP code, tracked as CVE-2026-98432 and rated 9.8. A remote, unauthenticated attacker can trigger it by sending connection requests with IPv4 Record Route or Timestamp options, potentially gaining remote code execution. The bug has existed since Linux 4.4. Ubuntu says fixes for 22.04, 24.04 and 26.04 LTS are in its opt-in testing channel, with no date.

The Russia-aligned Gorbag group has used a WinRAR vulnerability to deploy data-stealing malware against Ukrainian courts, city councils, and defense bodies. The group, active since at least February 2025, uses spearphishing emails to deliver its stealer, which harvests browser credentials, VPN settings, and documents before deleting itself. ESET suggests the group may act as an initial access broker, passing stolen data to other threat actors.

Harvard University confirmed that a breach of its Alumni Affairs and Development systems exposed the data of 851,000 unique email addresses. The ShinyHunters extortion gang claimed responsibility for stealing over 1 million records, including names, dates of birth, and donation details, after Harvard refused to pay a ransom.

The university stated that Social Security numbers, passwords, and payment card information were not stored in the affected systems.

ESET says Russia-aligned Gorbag has used spearphishing to hit Ukrainian courts, city councils, defense bodies and a foreign military aid transport hub since at least February 2025. Its stealer collects browser credentials, VPN settings and documents, then deletes itself. Through 2025 it used macro-enabled Excel files, and in early 2026 it shifted to RAR archives exploiting WinRAR flaw CVE-2025-8088.

The UK's National Cyber Security Centre warned that AI-powered ransomware attacks on critical infrastructure are highly likely by 2028. NCSC CEO Richard Horne said that AI will expose vulnerabilities that have been tolerated for too long, urging organizations to invest in cybersecurity.

The report noted that Chinese cyber activity is the most sophisticated challenge facing the UK, while Russia and China will routinely use AI for geopolitical goals.

Google and Mandiant researchers identified a new threat called LLMJacking, where criminals use stolen cloud access to run AI models at the victim's expense. In some cases, fraudulent cloud charges reached $1 million before attackers lost access. The technique involves bypassing front-end chatbots to target backend model resources directly, often through stolen API keys or cloud identity tokens.

Belarusian Cyber Partisans and Silent Crow said they accessed about 25,000 Rosstat computers and servers and stole roughly 23TB of data. They said the data includes wartime losses marked for official use only, and shared a chart suggesting as many as 50,000 Russian soldiers are killed in Ukraine each month. Ukraine's General Staff said Russia has lost 1,594,830 troops in Ukraine since February 2022.

OpenAI raised its bug bounty reward ranges, with midpoints for medium, high and critical findings more than quadrupled on average. Critical vulnerabilities in core products such as ChatGPT, Codex and the API Platform can earn base bounties of up to $30,000, while exceptional critical findings can reach $100,000, and total payouts can reach $172,000 with bonuses.

BTCPay Server urged users to install the latest version after Bitcoin and Litecoin were stolen from hot wallets on older instances. BTCPay Server said attacks targeted servers running version 2.4.1 or earlier, using a different method to exploit a vulnerability fixed in 2.4.2. Users on affected versions were advised to move to a fresh server with a new wallet, even if no theft was noticed.

General Motors agreed to pay $220 million to settle claims that it unlawfully collected and shared millions of drivers' location and driving behavior data with third parties. A coalition of 35 US states found that GM sold names, contact details, location data and driving habits to data brokers, which passed them to insurers. GM must now obtain consent before collecting or disclosing such data, and Arizona will receive $5.9 million.

Synology is urging users to update DiskStation Manager software after ransomware attacks on its NAS devices. Synology said threat actors are exploiting a vulnerability patched in December 2024 to target outdated DSM versions, encrypting data and demanding ransom. Customers reported C3RB3R ransomware locking files with a .L0CK3D extension, and Synology pointed to a November 2024 advisory listing three vulnerabilities.

The FBI accused North Korea of stealing over $6.3 billion from Binance on October 29, the largest hack of a cryptocurrency trading platform in history. Binance said a compromised DevOps engineer's laptop let attackers submit unauthorized withdrawals. Binance has reserved over $6.34 billion to cover losses, and the FBI said a North Korean actor converted stolen bitcoin into Ethereum and asked platforms to block linked addresses.

The Investigatory Powers Commissioner's Office said GCHQ estimates thousands of USB sticks, external drives, discs and memory cards cannot be immediately located. Some may hold data collected under the Investigatory Powers Act, raising privacy concerns. GCHQ said its tracking system was not robust enough and has commissioned a new tool, with the regulator planning written progress reports through 2026.

Germany's Federal Office for Information Security said several members of the Bundestag and other public figures received Apple threat notifications on their devices since October 29, 2026. Apple said it detected an attack using mercenary spyware, commercially developed software often used by state actors against targeted individuals. The BSI said it did not know whether the alerts indicated actual compromises or only attempted attacks.

HTTP2Shell, a critical remote code execution flaw in the Brotli compression library, affects runtimes and software including Node.js, Bun, Envoy and Python. Sweet said it observed exploitation attempts in 88% of the environments it monitors after disclosure. The root cause fix appeared in Brotli public source on February 27, but it was not recognized as a security fix for close to eight months.

VulnCheck said attackers are exploiting CVE-2026-58115, a CVSS 10.0 missing authentication flaw in Siemens SIMATIC IoT2050 Advanced devices with Node-RED installed. The flaw lets unauthenticated remote attackers create malicious flows and run arbitrary code with maximum privileges. Siemens fixed it in versions 4.3.4.1 or later, and VulnCheck observed exploit attempts that tried to download a Linux bot or exposed HTTP endpoints for commands.

Attackers are attempting to exploit unpatched CVE-2026-81648 in CryptoPayment Gateway WordPress plugin versions 1.2.1 to 1.2.2, a CVSS 10.0 flaw that can let unauthenticated users delete files and recover stored wallet credentials. Defused Cyber said in-the-wild attempts came from infrastructure marketed as Anonymous KYC-Free VPS Hosting. Site owners are advised to remove the plugin, rotate wallet keys and audit for changes.

Google said it worked with industry partners to dismantle a botnet of more than 1.3 million Android TV boxes that secretly rented users' internet connections through residential proxy services. The malware, dubbed XCPE, was loaded by Chinese TV box maker Videostrong Technology, and the takedown is expected to cut off access to more than 10 million other compromised devices. Google took legal action against the botnet's domains and servers.

Retailers in Belgium, Ireland, Sweden, Finland and Estonia suffered near identical attacks on supermarket refrigeration systems on Monday, weeks after a French freezer attack spoiled food and caused fires. The attacks caused sudden temperature changes in fridges and freezers, with incidents confirmed at Carrefour, Spar and Ahold Delhaize. Analysts cited outsourced maintenance and poor visibility of connected devices.

Britain's National Cyber Security Centre will warn of a real prospect of an unprecedented rise in cyber incidents in coming months. Chief Executive Richard Horne will say the risk comes from long tolerated vulnerabilities now found and exploited at scale, not from AI inventing new attacks. The NCSC will say AI powered malware is highly likely to be used in a ransomware attack on Britain's critical infrastructure by 2028.